herdr-remote 0.2.31 → 0.2.33

package/dist/connector/agent-watch.js

@@ -19,7 +19,10 @@ const AGENT_STATUS_SUBSCRIPTIONS = [
  *
  * A long-lived subscription provides fast refreshes on pane and workspace
  * focus changes; the five-second poll still repairs missed events and a
- * restarted Herdr server. Both paths only read the side-channel snapshot.
+ * restarted Herdr server. Both paths only read the side-channel snapshot, and
+ * events only invalidate it: Herdr's snapshots and events share no sequence,
+ * so each (re)started subscription and each event mid-read asks for a fresh
+ * read rather than patching the last one.
  */
 export class AgentWatch {
     socketPath;
@@ -30,6 +33,7 @@ export class AgentWatch {
     debounceTimer = null;
     subscription = null;
     pending = false;
+    stale = false;
     lastSummary = null;
     constructor(options, send) {
         this.socketPath = options.socketPath;
@@ -43,7 +47,7 @@ export class AgentWatch {
         this.pollTimer = setInterval(() => this.read(), AGENT_STATUS_POLL_MS);
         this.pollTimer.unref?.();
         try {
-            this.subscription = this.subscribe(this.socketPath, AGENT_STATUS_SUBSCRIPTIONS, () => this.scheduleRead());
+            this.subscription = this.subscribe(this.socketPath, AGENT_STATUS_SUBSCRIPTIONS, () => this.scheduleRead(), { onStarted: () => this.scheduleRead() });
         }
         catch {
             // A missing or restarting Herdr server leaves the regular poll in place.
@@ -63,6 +67,7 @@ export class AgentWatch {
             this.subscription.close();
             this.subscription = null;
         }
+        this.stale = false;
         this.lastSummary = null;
     }
     scheduleRead() {
@@ -84,9 +89,14 @@ export class AgentWatch {
      * Herdr's server not running is an ordinary state, not news.
      */
     async read() {
-        if (this.pending || !this.pollTimer)
+        if (!this.pollTimer)
+            return;
+        if (this.pending) {
+            this.stale = true;
             return;
+        }
         this.pending = true;
+        this.stale = false;
         let snapshot;
         try {
             const result = await this.request(this.socketPath, 'session.snapshot', {});
@@ -97,6 +107,9 @@ export class AgentWatch {
         }
         finally {
             this.pending = false;
+            // Something changed while this answer was in flight; it may predate it.
+            if (this.stale)
+                this.scheduleRead();
         }
         // Stopped while the answer was in flight; the browser it was for is gone.
         if (!this.pollTimer)

package/dist/connector/herdr-prefix-keys.js

@@ -0,0 +1,28 @@
+// The keys that put this workstation's Herdr into prefix mode. A browser has
+// to tell a Herdr command from typed text, and only Herdr's own config file
+// says which key starts one, so the host reads it and reports it in its hello.
+import fs from 'node:fs';
+import { sanitizeHerdrPrefixKeys } from 'herdr-remote-relay/protocol';
+import { herdrConfigPath } from '../socket-discovery.js';
+import { parseTomlSubset } from '../terminal-font/formats.js';
+/** What Herdr uses when `keys.prefix` is absent or names nothing it can read. */
+const DEFAULT_PREFIX_KEYS = ['ctrl+b'];
+/**
+ * `keys.prefix` from the Herdr config the connector's Herdr reads: one key or
+ * a list, each a combo like `ctrl+space`. Always at least one key, because
+ * Herdr itself falls back to `ctrl+b` when the file, the key or every entry
+ * is unusable.
+ */
+export function readHerdrPrefixKeys(env = process.env, platform = process.platform) {
+    let text;
+    try {
+        text = fs.readFileSync(herdrConfigPath(env, platform), 'utf8');
+    }
+    catch {
+        // No readable config file means Herdr runs on its defaults.
+        return [...DEFAULT_PREFIX_KEYS];
+    }
+    const configured = parseTomlSubset(text)['keys.prefix'];
+    const entries = typeof configured === 'string' ? [configured] : configured;
+    return sanitizeHerdrPrefixKeys(entries) ?? [...DEFAULT_PREFIX_KEYS];
+}

package/dist/connector/host-connector.js

@@ -3,7 +3,7 @@
 // message to the part of the connector that owns it.
 import os from 'node:os';
 import path from 'node:path';
-import { CAPABILITY, PROTOCOL_VERSION, unpackStreamFrame, } from 'herdr-remote-relay/protocol';
+import { unpackStreamFrame } from 'herdr-remote-relay/protocol';
 import { WebSocket } from 'ws';
 import { loadConfig } from '../config.js';
 import { EXIT_AUTH_FAILED, EXIT_REPLACED } from '../exit-codes.js';
@@ -16,6 +16,7 @@ import { randomToken } from 'herdr-remote-relay/state';
 import { openAdminTabFor } from './admin-tab.js';
 import { AgentWatch } from './agent-watch.js';
 import { FontServer } from './font-server.js';
+import { hostHello } from './host-hello.js';
 import { acquireHostLock, releaseHostLock } from './lock.js';
 import { Sessions } from './sessions.js';
 import { UpdateReport } from './update-report.js';
@@ -178,29 +179,14 @@ export class HostConnector {
             }
             ws.isAlive = true;
             this.authFailure = false;
-            sendJson(ws, {
-                type: 'host_hello',
-                protocol: PROTOCOL_VERSION,
+            sendJson(ws, hostHello({
                 hostId: this.hostId,
                 token: this.hostToken,
-                password: this.relayPassword || null,
-                hostname: os.hostname(),
-                platform: process.platform,
-                ...(process.platform === 'win32' &&
-                    (process.env.MSYSTEM || /(?:^|[\\/])(?:bash|sh)(?:\.exe)?$/i.test(process.env.SHELL || ''))
-                    ? { shellProfile: 'git-bash' }
-                    : {}),
-                arch: process.arch,
+                password: this.relayPassword,
                 version: this.updates.runningVersion,
-                terminalPalette: this.terminalPalette || null,
+                terminalPalette: this.terminalPalette,
                 terminalFont: this.font.publicFont(),
-                capabilities: [
-                    CAPABILITY.hostHandoff,
-                    CAPABILITY.idleHeartbeat,
-                    CAPABILITY.binaryFrameV2,
-                    ...(process.platform === 'win32' ? [CAPABILITY.adminTabs] : []),
-                ],
-            });
+            }));
             // The relay sends host_ready with the current browser count. No business
             // heartbeat is started until that message says somebody is watching.
         });

package/dist/connector/host-hello.js

@@ -0,0 +1,32 @@
+// The first message a workstation sends the relay: who it is, what it runs,
+// and the facts about its terminal and Herdr that a browser cannot learn itself.
+import os from 'node:os';
+import { CAPABILITY, PROTOCOL_VERSION } from 'herdr-remote-relay/protocol';
+import { readHerdrPrefixKeys } from './herdr-prefix-keys.js';
+/** Built afresh for each connection, so a reconnect reports the config as it is now. */
+export function hostHello(identity) {
+    return {
+        type: 'host_hello',
+        protocol: PROTOCOL_VERSION,
+        hostId: identity.hostId,
+        token: identity.token,
+        password: identity.password || null,
+        hostname: os.hostname(),
+        platform: process.platform,
+        ...(process.platform === 'win32' &&
+            (process.env.MSYSTEM || /(?:^|[\\/])(?:bash|sh)(?:\.exe)?$/i.test(process.env.SHELL || ''))
+            ? { shellProfile: 'git-bash' }
+            : {}),
+        arch: process.arch,
+        version: identity.version,
+        terminalPalette: identity.terminalPalette || null,
+        terminalFont: identity.terminalFont,
+        herdrPrefixKeys: readHerdrPrefixKeys(),
+        capabilities: [
+            CAPABILITY.hostHandoff,
+            CAPABILITY.idleHeartbeat,
+            CAPABILITY.binaryFrameV2,
+            ...(process.platform === 'win32' ? [CAPABILITY.adminTabs] : []),
+        ],
+    };
+}

package/dist/connector/lock.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir } from 'herdr-remote-relay/state';
-import { pidAlive } from '../lib/process.js';
+import { processStart, stillRunning } from '../lib/process.js';
 function readOwner(lockPath) {
     try {
         return JSON.parse(fs.readFileSync(lockPath, 'utf8'));
@@ -19,21 +19,28 @@ function lockError(message, code) {
 }
 /**
  * Take the lock, or throw `HOST_ALREADY_RUNNING` when a live process holds it.
- * A lock left by a dead process is removed and taken over.
+ * A lock left by a dead process is removed and taken over — including one whose
+ * pid a reboot handed to an unrelated process, which would otherwise keep every
+ * later connector standing down.
  */
 export function acquireHostLock(lockPath, hostId) {
     ensureDir(path.dirname(lockPath));
     for (let attempt = 0; attempt < 2; attempt += 1) {
         try {
             const fd = fs.openSync(lockPath, 'wx', 0o600);
-            fs.writeFileSync(fd, `${JSON.stringify({ pid: process.pid, hostId, startedAt: new Date().toISOString() })}\n`);
+            fs.writeFileSync(fd, `${JSON.stringify({
+                pid: process.pid,
+                processStart: processStart(process.pid),
+                hostId,
+                startedAt: new Date().toISOString(),
+            })}\n`);
             return fd;
         }
         catch (error) {
             if (error.code !== 'EEXIST')
                 throw error;
             const owner = readOwner(lockPath);
-            if (owner && pidAlive(owner.pid)) {
+            if (owner && stillRunning([owner]).length > 0) {
                 throw lockError(`another host connector is already running (pid ${owner.pid})`, 'HOST_ALREADY_RUNNING');
             }
             try {

package/dist/herdr-api.js

@@ -122,9 +122,14 @@ function requestHerdr(socketPath, method, params = {}, options = {}) {
  * They share a socket, but are separate NDJSON messages. A subscription never
  * starts or writes to a terminal, so an unavailable socket is only a reason to
  * retry this side channel.
+ *
+ * Events are not replayed across connections, and from Herdr 0.9.2 a reader
+ * that falls behind gets an `events_lost` error carrying the request id and a
+ * closed socket. Both end in a reconnect, and `onStarted` fires on every
+ * acknowledgement so the caller can re-read what it may have missed.
  */
 function subscribeHerdr(socketPath, subscriptions, onEvent, options = {}) {
-    const { connect = net.connect, retryBaseMs = SUBSCRIBE_RETRY_BASE_MS, retryMaxMs = SUBSCRIBE_RETRY_MAX_MS, } = options;
+    const { connect = net.connect, retryBaseMs = SUBSCRIBE_RETRY_BASE_MS, retryMaxMs = SUBSCRIBE_RETRY_MAX_MS, onStarted, } = options;
     let socket = null;
     let reconnectTimer = null;
     let handshakeTimer = null;
@@ -203,6 +208,7 @@ function subscribeHerdr(socketPath, subscriptions, onEvent, options = {}) {
                     }
                     acknowledged = true;
                     retryCount = 0;
+                    onStarted?.();
                 }
                 else if (acknowledged &&
                     typeof message?.event === 'string' &&

package/dist/herdr-command.js

@@ -29,8 +29,13 @@ const COMMAND_NAME = 'herdr';
  * machine in the background stops resizing somebody else's focused pane, and a
  * large paste no longer disconnects the client — and pasting is how an image
  * reaches an agent from a phone.
+ *
+ * 0.9.3 because a browser types through escape sequences: 0.9.2 stopped a tap
+ * on a pane from sending a stray Escape to a working agent and stopped mouse
+ * reports split across reads from leaking into the shell, and it also broke
+ * Escape followed by a key — Alt+B, Alt+F, Alt+Backspace — which 0.9.3 mends.
  */
-const MIN_HERDR_VERSION = '0.9.1';
+const MIN_HERDR_VERSION = '0.9.3';
 /** Where a user-level install lands, in the order we trust it. */
 const FALLBACK_DIRECTORIES = [
     '~/.local/bin',
@@ -224,7 +229,7 @@ function herdrVersion({ command, timeout = 10_000, ...lookup } = {}) {
 /** The one line that tells a user why an older Herdr is a problem here. */
 function herdrOutdatedMessage(version) {
     return (`Herdr ${version} is older than ${MIN_HERDR_VERSION}, which herdr-remote is written against. ` +
-        'Run "herdr update" — window titles, background machine activation and large pastes all ' +
+        'Run "herdr update" — window titles, large pastes, taps on a pane and Alt shortcuts all ' +
         'misbehave in browser windows before that release.');
 }
 /** The one message a user needs to fix a missing install themselves. */

package/dist/i18n/en.js

@@ -163,7 +163,7 @@ const en = {
     'herdr.autoStartHint': 'Off: Herdr starts only when you run it, or when you confirm it from a browser. On: herdr-remote also starts it every time it starts, at boot included. Takes effect the next time herdr-remote starts.',
     'herdr.cliMissing': 'Command herdr not found. Set HERDR_BIN_PATH to its full path.',
     'herdr.version': 'Herdr version',
-    'herdr.versionOutdated': 'Herdr {version} is older than {minimum}. Run "herdr update": window titles, background machine activation and large pastes misbehave in browser windows before that release.',
+    'herdr.versionOutdated': 'Herdr {version} is older than {minimum}. Run "herdr update": window titles, large pastes, taps on a pane and Alt shortcuts misbehave in browser windows before that release.',
     'about.title': 'Language & about',
     'about.language': 'Interface language',
     'about.languageAuto': 'Follow system ({detected})',

package/dist/i18n/zh.js

@@ -162,7 +162,7 @@ const zh = {
     'herdr.autoStartHint': '关：Herdr 只在你手动运行，或在浏览器里确认后才启动。开：herdr-remote 每次启动（包括开机）时一并启动 Herdr。下次 herdr-remote 启动时生效。',
     'herdr.cliMissing': '未找到 herdr 命令，可将 HERDR_BIN_PATH 设为其完整路径。',
     'herdr.version': 'Herdr 版本',
-    'herdr.versionOutdated': 'Herdr {version} 低于 {minimum}，请运行 “herdr update”：在该版本之前，浏览器窗口的标题、后台机器激活与大段粘贴都会出问题。',
+    'herdr.versionOutdated': 'Herdr {version} 低于 {minimum}，请运行 “herdr update”：在该版本之前，浏览器窗口的标题、大段粘贴、点按窗格与 Alt 快捷键都会出问题。',
     'about.title': '语言与关于',
     'about.language': '界面语言',
     'about.languageAuto': '跟随系统（{detected}）',

package/dist/keepalive/detached.js

@@ -4,19 +4,23 @@ import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { ensureDir, readJson, writeJsonAtomic } from 'herdr-remote-relay/state';
-import { pidAlive } from '../lib/process.js';
+import { processStart, stillRunning } from '../lib/process.js';
 import { logPath, stateDir } from '../paths.js';
 import { cliEntryPoint, serviceEnvironment } from './environment.js';
 function fallbackPidPath() {
     return path.join(stateDir(), 'supervisor.pid');
 }
-function readPid() {
+/**
+ * The supervisor the pid file names, if it is still that process. The file
+ * outlives a reboot; its pid alone would then name something unrelated.
+ */
+function runningPid() {
     const record = readJson(fallbackPidPath(), {});
-    return Number.isInteger(record.pid) ? record.pid : null;
+    return stillRunning([record]).length > 0 ? record.pid : null;
 }
 function start() {
-    const running = readPid();
-    if (pidAlive(running))
+    const running = runningPid();
+    if (running !== null)
         return { ok: true, alreadyRunning: true, pid: running };
     ensureDir(stateDir());
     const logFd = fs.openSync(logPath('supervisor'), 'a');
@@ -30,7 +34,11 @@ function start() {
             stdio: ['ignore', logFd, logFd],
         });
         child.unref();
-        writeJsonAtomic(fallbackPidPath(), { pid: child.pid, startedAt: new Date().toISOString() });
+        writeJsonAtomic(fallbackPidPath(), {
+            pid: child.pid,
+            processStart: child.pid ? processStart(child.pid) : null,
+            startedAt: new Date().toISOString(),
+        });
         return { ok: true, pid: child.pid, note: 'this fallback does not survive a reboot' };
     }
     finally {
@@ -38,8 +46,8 @@ function start() {
     }
 }
 function stopAndForget() {
-    const pid = readPid();
-    if (pid !== null && pidAlive(pid)) {
+    const pid = runningPid();
+    if (pid !== null) {
         try {
             process.kill(pid, 'SIGTERM');
         }
@@ -58,8 +66,8 @@ export function detachedLogsHint(platform = process.platform, logFile = logPath(
 export const detached = {
     name: 'supervisor',
     status() {
-        const pid = readPid();
-        const alive = pidAlive(pid);
+        const pid = runningPid();
+        const alive = pid !== null;
         return {
             manager: 'supervisor',
             installed: alive,

package/dist/lib/process.js

@@ -1,3 +1,10 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+const PROCESS_QUERY_TIMEOUT_MS = 10_000;
+// Records written before start tokens existed carry only a pid. Until none are
+// left, such a record is trusted only while its process runs one of our entry
+// points: the relay, the host connector or `herdr-remote run`.
+const OUR_ENTRY_POINT = /herdr-remote-relay\.js|connector[\\/]main\.js|herdr-remote\.js"?\s+run\b/;
 /** Whether `pid` names a running process, including one owned by another user. */
 export function pidAlive(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
@@ -10,3 +17,116 @@ export function pidAlive(pid) {
         return error.code === 'EPERM';
     }
 }
+function runCommand(command, args) {
+    const result = spawnSync(command, args, {
+        encoding: 'utf8',
+        // The same instant must print the same text whenever and wherever it is asked.
+        env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' },
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: PROCESS_QUERY_TIMEOUT_MS,
+        windowsHide: true,
+    });
+    // The exit code is not trusted: ps and PowerShell fail when any one pid is
+    // gone, yet still print the rest. A command that could not run prints nothing.
+    return typeof result.stdout === 'string' ? result.stdout : '';
+}
+/** `<pid> <value>` lines, as ps and our PowerShell queries print them. */
+function parsePidLines(output) {
+    const details = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^\s*(\d+)\s+(\S.*?)\s*$/.exec(line);
+        if (match)
+            details.set(Number(match[1]), match[2]);
+    }
+    return details;
+}
+function linuxDetails(pids, detail, run) {
+    let bootId = '';
+    if (detail === 'start') {
+        try {
+            // Start times count clock ticks since boot, so they only identify a
+            // process together with the boot they were counted in.
+            bootId = fs.readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        }
+        catch {
+            // A /proc without boot ids (some sandboxes) still has ps.
+            return psDetails(pids, detail, run);
+        }
+    }
+    const details = new Map();
+    for (const pid of pids) {
+        let text;
+        try {
+            text = fs.readFileSync(`/proc/${pid}/${detail === 'start' ? 'stat' : 'cmdline'}`, 'utf8');
+        }
+        catch {
+            // Not running, or hidden from us: either way it is not a process we can vouch for.
+            continue;
+        }
+        if (detail === 'command') {
+            details.set(pid, text.replaceAll('\0', ' ').trim());
+            continue;
+        }
+        // The command name before this may itself contain spaces and parentheses;
+        // after it, field 3 (state) comes first and field 22 is the start time.
+        const fields = text.slice(text.lastIndexOf(')') + 2).split(' ');
+        if (fields[19])
+            details.set(pid, `${bootId}:${fields[19]}`);
+    }
+    return details;
+}
+function psDetails(pids, detail, run) {
+    const column = detail === 'start' ? 'lstart' : 'command';
+    return parsePidLines(run('ps', ['-o', `pid=,${column}=`, '-p', pids.join(',')]));
+}
+function windowsDetails(pids, detail, run) {
+    const script = detail === 'start'
+        ? // StartTime is empty for processes we may not inspect; those are not ours anyway.
+            `Get-Process -Id ${pids.join(',')} -ErrorAction SilentlyContinue | Where-Object StartTime | ForEach-Object { "$($_.Id) $($_.StartTime.ToFileTimeUtc())" }`
+        : `Get-CimInstance Win32_Process -Filter "${pids.map((pid) => `ProcessId=${pid}`).join(' OR ')}" | ForEach-Object { "$($_.ProcessId) $($_.CommandLine)" }`;
+    return parsePidLines(run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script]));
+}
+function processDetails(pids, detail, platform, run) {
+    // Dead pids are the common case after a clean stop, and ruling them out here
+    // saves spawning ps or PowerShell just to hear so.
+    const candidates = [...new Set(pids)].filter(pidAlive);
+    if (candidates.length === 0)
+        return new Map();
+    if (platform === 'linux')
+        return linuxDetails(candidates, detail, run);
+    if (platform === 'win32')
+        return windowsDetails(candidates, detail, run);
+    return psDetails(candidates, detail, run);
+}
+/**
+ * When each running process in `pids` started, as opaque tokens; pids that are
+ * not running, or that the system will not describe, are left out.
+ *
+ * A pid alone does not identify a process: the number goes to another process
+ * once this one exits, and after a reboot the same boot-time services land on
+ * the same numbers again. On Linux the number of a thread in another process
+ * even passes `pidAlive`. Recorded next to its pid, this token only ever
+ * matches the process it was read from.
+ */
+export function processStarts(pids, platform = process.platform, run = runCommand) {
+    return processDetails(pids, 'start', platform, run);
+}
+/** The command line of each running process in `pids`, which the system is willing to show. */
+export function processCommands(pids, platform = process.platform, run = runCommand) {
+    return processDetails(pids, 'command', platform, run);
+}
+export function processStart(pid, platform = process.platform) {
+    return processStarts([pid], platform).get(pid) ?? null;
+}
+/** The records that still name the very process they were taken from. */
+export function stillRunning(records) {
+    const pidsOf = (list) => list.map((record) => record.pid).filter((pid) => Number.isInteger(pid));
+    const legacy = records.filter((record) => typeof record.processStart !== 'string');
+    const starts = processStarts(pidsOf(records.filter((record) => !legacy.includes(record))));
+    const commands = legacy.length > 0 ? processCommands(pidsOf(legacy)) : new Map();
+    return records.filter((record) => legacy.includes(record)
+        ? // We only ever write start tokens, so a legacy record naming our own pid
+            // was left by an earlier process that happened to have it.
+            record.pid !== process.pid && OUR_ENTRY_POINT.test(commands.get(record.pid) ?? '')
+        : starts.get(record.pid) === record.processStart);
+}

package/dist/lifecycle.js

@@ -6,8 +6,7 @@
 // here so the managed and unmanaged paths behave the same from the outside.
 import { loadConfig } from './config.js';
 import * as keepalive from './keepalive/index.js';
-import { pidAlive } from './lib/process.js';
-import { readRuntime } from './runtime.js';
+import { managedPids, readRuntime } from './runtime.js';
 import { restartServices, startServices, statusServices, stopServices } from './service.js';
 function managerInUse(config) {
     const status = keepalive.status(config);
@@ -51,7 +50,10 @@ function restartAll(config = loadConfig()) {
 }
 /** Whether the host connector is up, under a keep-alive manager or detached. */
 function servicesRunning(config = loadConfig()) {
-    return Boolean(managerInUse(config)?.active || pidAlive(readRuntime().hostPid));
+    if (managerInUse(config)?.active)
+        return true;
+    const state = readRuntime();
+    return managedPids(state).some(({ pid }) => pid === state.hostPid);
 }
 /** Stop Windows keep-alive processes while npm replaces their package files. */
 async function whileServicesStopped(config, task, { platform = process.platform, isRunning = () => servicesRunning(config), stop = stopAll, start = startAll, } = {}) {

package/dist/pty-session.js

@@ -1,5 +1,28 @@
 import os from 'node:os';
 import { nodePty } from './node-pty-loader.js';
+/**
+ * Variables that name the terminal this process was started from. The Herdr
+ * client's outer terminal is the browser's xterm.js, and from Herdr 0.9.2 the
+ * client reads these to pick image transports: one that believes it runs in
+ * Ghostty, kitty or WezTerm hands images over as local file paths no browser
+ * can open. Herdr strips the same list from its own panes.
+ */
+const OUTER_TERMINAL_ENV = [
+    'TERM_PROGRAM',
+    'TERM_PROGRAM_VERSION',
+    'ITERM_SESSION_ID',
+    'LC_TERMINAL',
+    'LC_TERMINAL_VERSION',
+    'WEZTERM_PANE',
+    'KITTY_WINDOW_ID',
+    'WT_SESSION',
+    'TMUX',
+    'TMUX_PANE',
+    'STY',
+    'ZELLIJ',
+    'ZELLIJ_SESSION_NAME',
+    'ZELLIJ_PANE_ID',
+];
 class PtySession {
     static DEFAULT_COLS = 100;
     static DEFAULT_ROWS = 30;
@@ -29,12 +52,14 @@ class PtySession {
         this.terminal = null;
         this.startedAt = null;
     }
-    static childEnv(socketPath) {
-        const env = { ...process.env };
+    static childEnv(socketPath, source = process.env) {
+        const env = { ...source };
         for (const key of Object.keys(env)) {
             if (key.startsWith('HERDR_'))
                 delete env[key];
         }
+        for (const key of OUTER_TERMINAL_ENV)
+            delete env[key];
         if (socketPath)
             env.HERDR_SOCKET_PATH = socketPath;
         env.TERM = 'xterm-256color';

package/dist/runtime.js

@@ -2,7 +2,7 @@
 // for it, and facts other modules remember there (terminal palette and font).
 // Every read and write of that file goes through here.
 import { ensureDir, randomToken, readJson, writeJsonAtomic } from 'herdr-remote-relay/state';
-import { pidAlive } from './lib/process.js';
+import { processStart, stillRunning } from './lib/process.js';
 import { configDir, runtimeStatePath, stateDir } from './paths.js';
 const RUNTIME_VERSION = 2;
 export function readRuntime() {
@@ -73,34 +73,35 @@ export function regenerateHostIdentity() {
  * (minus dead entries) precisely so no writer can lose another writer's pids.
  */
 export function recordManagedPid(state, name, pid) {
-    const existing = Array.isArray(state.managedPids) ? state.managedPids : [];
-    const kept = existing.filter((entry) => entry && entry.pid !== pid && pidAlive(entry.pid));
-    // Only track something that is actually running: a pid that already exited
-    // would sit in the ledger until its number is recycled by an unrelated
-    // process, which we would then happily signal.
-    if (Number.isInteger(pid) && pidAlive(pid)) {
-        kept.push({ name, pid: pid, startedAt: new Date().toISOString() });
+    const existing = Array.isArray(state.managedPids) ? state.managedPids.filter(Boolean) : [];
+    const kept = stillRunning(existing.filter((entry) => entry.pid !== pid));
+    // Only track something that is actually running, and together with its start
+    // token: the ledger outlives a reboot, and a bare pid it kept would then name
+    // whichever unrelated process got that number next — which we would signal.
+    const start = Number.isInteger(pid) ? processStart(pid) : null;
+    if (start) {
+        kept.push({
+            name,
+            pid: pid,
+            processStart: start,
+            startedAt: new Date().toISOString(),
+        });
     }
     state.managedPids = kept;
     return state;
 }
-/** Every process we believe we started, alive right now. */
+/**
+ * Every process we started that is still running, and still that process.
+ *
+ * Only the ledger counts. `supervisorPid`, `relayPid` and `hostPid` are bare
+ * numbers that survive a reboot, and trusting them would signal whichever
+ * unrelated process inherited one.
+ */
 export function managedPids(state = readRuntime()) {
-    const pids = new Map();
-    // Supervisor first and never overwritten: `stopServices` relies on the order
-    // to signal it before its children, and one pid can appear under several
-    // fields.
-    for (const [name, pid] of [
-        ['supervisor', state.supervisorPid],
-        ['host', state.hostPid],
-        ['relay', state.relayPid],
-    ]) {
-        if (pidAlive(pid) && !pids.has(pid))
-            pids.set(pid, name);
-    }
+    const unique = new Map();
     for (const entry of state.managedPids || []) {
-        if (entry && pidAlive(entry.pid) && !pids.has(entry.pid))
-            pids.set(entry.pid, entry.name);
+        if (entry && !unique.has(entry.pid))
+            unique.set(entry.pid, entry);
     }
-    return [...pids].map(([pid, name]) => ({ pid, name }));
+    return stillRunning([...unique.values()]);
 }

package/dist/service.js

@@ -7,7 +7,6 @@ import path from 'node:path';
 import { ensureDir } from 'herdr-remote-relay/state';
 import { loadConfig } from './config.js';
 import { findHerdrCommand, herdrVersion, MIN_HERDR_VERSION, resolveHerdrCommand, } from './herdr-command.js';
-import { pidAlive } from './lib/process.js';
 import { preferredLanAddress } from './net-interfaces.js';
 import { logPath, PACKAGE_ROOT, stateDir } from './paths.js';
 import { healthUrl, hostHeaders, requestJson, waitForHost, waitForRelay } from './relay-client.js';
@@ -119,16 +118,18 @@ export function startServices() {
     const state = ensureRuntime();
     const next = { ...state };
     const specs = serviceSpecs(config, state);
+    const running = managedPids(next);
+    const isRunning = (pid) => running.some((entry) => entry.pid === pid);
     for (const spec of specs) {
         const field = PID_FIELDS[spec.name];
-        if (pidAlive(next[field]))
+        if (isRunning(next[field]))
             continue;
         next[field] = spawnDetached(spec) ?? null;
         recordManagedPid(next, spec.name, next[field]);
     }
     // A relay that is no longer part of the plan (switched to remote mode) must
     // not be left running on the old port.
-    if (!specs.some((spec) => spec.name === 'relay') && pidAlive(next.relayPid)) {
+    if (!specs.some((spec) => spec.name === 'relay') && isRunning(next.relayPid)) {
         try {
             process.kill(next.relayPid, 'SIGTERM');
         }
@@ -140,20 +141,21 @@ export function startServices() {
     next.startedAt = next.startedAt || new Date().toISOString();
     next.mode = config.relay.mode;
     writeRuntime(next);
+    const live = managedPids(next);
     return {
         ok: true,
         mode: config.relay.mode,
         relay: {
             local: runsLocalRelay(config),
             pid: next.relayPid || null,
-            alive: pidAlive(next.relayPid),
+            alive: live.some(({ pid }) => pid === next.relayPid),
             bind: runsLocalRelay(config) ? bindAddress(config) : null,
             port: config.relay.port,
             remoteUrl: config.relay.remoteUrl || null,
         },
         host: {
             pid: next.hostPid || null,
-            alive: pidAlive(next.hostPid),
+            alive: live.some(({ pid }) => pid === next.hostPid),
             socketPath: resolveSocketPath(config.herdr.socketPath),
         },
         publicUrl: resolvePublicUrl(config, preferredLanAddress()),
@@ -190,6 +192,7 @@ export function restartServices() {
 export async function statusServices() {
     const config = loadConfig();
     const state = readRuntime();
+    const live = managedPids(state);
     const lanAddress = preferredLanAddress();
     let health;
     try {
@@ -213,7 +216,7 @@ export async function statusServices() {
         relay: {
             local: runsLocalRelay(config),
             pid: state.relayPid || null,
-            alive: runsLocalRelay(config) ? pidAlive(state.relayPid) : null,
+            alive: runsLocalRelay(config) ? live.some(({ pid }) => pid === state.relayPid) : null,
             bind: runsLocalRelay(config) ? bindAddress(config) : null,
             port: config.relay.port,
             remoteUrl: config.relay.remoteUrl || null,
@@ -221,7 +224,7 @@ export async function statusServices() {
         },
         host: {
             pid: state.hostPid || null,
-            alive: pidAlive(state.hostPid),
+            alive: live.some(({ pid }) => pid === state.hostPid),
             hostId: state.hostId || null,
             socketPath,
             socketExists: Boolean(socketPath) && fs.existsSync(socketPath),

package/dist/socket-discovery.js

@@ -1,18 +1,28 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-function defaultSocketPath(env = process.env, platform = process.platform) {
-    if (env.HERDR_SOCKET_PATH)
-        return env.HERDR_SOCKET_PATH;
+/**
+ * Herdr's own config directory, resolved as Herdr does (`XDG_CONFIG_HOME`
+ * first on every platform, then the platform's home for it), so the socket
+ * and `config.toml` are found wherever Herdr put them.
+ */
+function herdrConfigDir(env = process.env, platform = process.platform) {
     if (platform === 'win32') {
         const configHome = env.XDG_CONFIG_HOME ||
             env.APPDATA ||
             (env.USERPROFILE && path.join(env.USERPROFILE, 'AppData', 'Roaming')) ||
             path.join(os.homedir(), 'AppData', 'Roaming');
-        return path.join(configHome, 'herdr', 'herdr.sock');
+        return path.join(configHome, 'herdr');
     }
     const configHome = env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
-    return path.join(configHome, 'herdr', 'herdr.sock');
+    return path.join(configHome, 'herdr');
+}
+function defaultSocketPath(env = process.env, platform = process.platform) {
+    return env.HERDR_SOCKET_PATH || path.join(herdrConfigDir(env, platform), 'herdr.sock');
+}
+/** The `config.toml` Herdr reads; `HERDR_CONFIG_PATH` names it outright. */
+function herdrConfigPath(env = process.env, platform = process.platform) {
+    return env.HERDR_CONFIG_PATH || path.join(herdrConfigDir(env, platform), 'config.toml');
 }
 /**
  * On Windows, Herdr uses this path itself as the GenericNamespaced pipe name;
@@ -57,4 +67,4 @@ function inspectSocket(socketPath, options = {}) {
         };
     }
 }
-export { defaultSocketPath, herdrEndpoint, resolveSocketPath, inspectSocket };
+export { defaultSocketPath, herdrConfigPath, herdrEndpoint, resolveSocketPath, inspectSocket };

package/dist/supervisor.js

@@ -6,7 +6,7 @@ import { ensureDir } from 'herdr-remote-relay/state';
 import { ensureRuntime, managedPids, recordManagedPid, updateRuntime, } from './runtime.js';
 import { baseEnvironment, serviceSpecs } from './service.js';
 import { EXIT_REPLACED, EXIT_AUTH_FAILED } from './exit-codes.js';
-import { pidAlive } from './lib/process.js';
+import { pidAlive, stillRunning } from './lib/process.js';
 const MIN_BACKOFF_MS = 500;
 const MAX_BACKOFF_MS = 30_000;
 // A child that stayed up this long is considered healthy, so the next crash
@@ -50,6 +50,10 @@ class Supervisor {
      * spawned died with EADDRINUSE and retried forever, while the orphaned host
      * connector and ours both claimed the same host id on the relay and kicked
      * each other off — which is what browsers saw as an endless reconnect.
+     *
+     * Only ledger entries whose start token still matches are touched: the
+     * ledger survives a reboot, and its pids then belong to whatever the new
+     * boot started.
      */
     async reclaimStrays({ timeoutMs = 5000 } = {}) {
         const strays = managedPids().filter((entry) => entry.pid !== process.pid);
@@ -79,9 +83,8 @@ class Supervisor {
                 setTimeout(resolve, 100);
             });
         }
-        for (const { pid, name } of strays) {
-            if (!pidAlive(pid))
-                continue;
+        // Checked again before the harder signal, in case the number moved on meanwhile.
+        for (const { pid, name } of stillRunning(strays)) {
             this.emit({
                 type: 'reclaim',
                 name,
@@ -284,7 +287,7 @@ class Supervisor {
                 current.relayPid = null;
                 current.hostPid = null;
                 current.startedAt = null;
-                current.managedPids = (current.managedPids || []).filter((entry) => entry && pidAlive(entry.pid));
+                current.managedPids = stillRunning((current.managedPids || []).filter(Boolean));
             });
         }
         catch {

package/dist/terminal-font/formats.js

@@ -193,10 +193,28 @@ export function parseJsonc(text) {
         return null;
     }
 }
+/** `line` up to a `#` that starts a comment, not one inside a string. */
+function withoutTomlComment(line) {
+    let quote = '';
+    for (let i = 0; i < line.length; i += 1) {
+        const char = line[i];
+        if (quote) {
+            if (char === '\\' && quote === '"')
+                i += 1;
+            else if (char === quote)
+                quote = '';
+        }
+        else if (char === '"' || char === "'")
+            quote = char;
+        else if (char === '#')
+            return line.slice(0, i);
+    }
+    return line;
+}
 /**
- * Just enough TOML for Alacritty's font keys: tables, dotted keys, strings,
- * numbers, inline tables and (possibly multi-line) string arrays. Returns a
- * flat `dotted.key → value` map.
+ * Just enough TOML for Alacritty's font keys and Herdr's `keys.prefix`:
+ * tables, dotted keys, strings, numbers, inline tables and (possibly
+ * multi-line) string arrays. Returns a flat `dotted.key → value` map.
  */
 export function parseTomlSubset(text) {
     const values = {};
@@ -253,11 +271,13 @@ export function parseTomlSubset(text) {
         if (equals === -1)
             continue;
         let rawValue = line.slice(equals + 1);
-        // An array may span lines; gather it before assigning.
-        if (rawValue.trim().startsWith('[') && !rawValue.includes(']')) {
+        if (rawValue.trim().startsWith('[')) {
+            // A comment inside an array may hold quotes or a `]` of its own.
+            rawValue = withoutTomlComment(rawValue);
+            // An array may span lines; gather it before assigning.
             while (index + 1 < lines.length && !rawValue.includes(']')) {
                 index += 1;
-                rawValue += ` ${lines[index].trim()}`;
+                rawValue += ` ${withoutTomlComment(lines[index]).trim()}`;
             }
         }
         assign(table, line.slice(0, equals), rawValue);

package/dist/terminal-font/terminals.js

@@ -19,6 +19,15 @@ const TERMINAL_PROCESSES = [
     [/^xterm$/, 'xterm'],
     [/^(urxvt|urxvtd|rxvt)$/, 'urxvt'],
 ];
+/** macOS app bundle ids, which every process an app starts inherits. */
+const BUNDLE_TERMINALS = {
+    'com.apple.Terminal': 'apple-terminal',
+    'com.googlecode.iterm2': 'iterm2',
+    'com.microsoft.VSCode': 'vscode',
+    'com.mitchellh.ghostty': 'ghostty',
+    'com.github.wez.wezterm': 'wezterm',
+    'net.kovidgoyal.kitty': 'kitty',
+};
 /**
  * The emulator a process runs under, from its own ancestry first.
  *
@@ -37,10 +46,15 @@ export function identifyTerminal({ env = process.env, ancestry = [], } = {}) {
                 return id;
         }
     }
+    // From Herdr 0.9.2 a pane says TERM_PROGRAM=herdr and loses the terminal's
+    // session markers, so a start from inside Herdr falls through to markers
+    // Herdr leaves alone: macOS's app bundle id, ITERM_PROFILE, KITTY_PID,
+    // WT_PROFILE_ID.
     const program = env.TERM_PROGRAM || '';
+    const bundle = env.__CFBundleIdentifier || '';
     if (program === 'vscode')
         return 'vscode';
-    if (program === 'iTerm.app' || env.ITERM_SESSION_ID)
+    if (program === 'iTerm.app' || env.ITERM_SESSION_ID || env.ITERM_PROFILE)
         return 'iterm2';
     if (program === 'Apple_Terminal')
         return 'apple-terminal';
@@ -48,7 +62,7 @@ export function identifyTerminal({ env = process.env, ancestry = [], } = {}) {
         return 'wezterm';
     if (program === 'ghostty' || env.GHOSTTY_RESOURCES_DIR)
         return 'ghostty';
-    if (env.KITTY_WINDOW_ID || env.TERM === 'xterm-kitty')
+    if (env.KITTY_WINDOW_ID || env.KITTY_PID || env.TERM === 'xterm-kitty')
         return 'kitty';
     if (env.ALACRITTY_SOCKET || env.ALACRITTY_WINDOW_ID || env.ALACRITTY_LOG)
         return 'alacritty';
@@ -64,8 +78,10 @@ export function identifyTerminal({ env = process.env, ancestry = [], } = {}) {
         return 'gnome-terminal';
     if (/^rxvt-unicode/.test(env.TERM || ''))
         return 'urxvt';
+    if (Object.hasOwn(BUNDLE_TERMINALS, bundle))
+        return BUNDLE_TERMINALS[bundle];
     // WT_SESSION is inherited by nested terminals, so specific terminal markers win first.
-    if (env.WT_SESSION)
+    if (env.WT_SESSION || env.WT_PROFILE_ID)
         return 'windows-terminal';
     // Last: a terminal started from xterm inherits this too.
     if (env.XTERM_VERSION)

package/herdr-plugin.toml

@@ -1,7 +1,7 @@
 id = "herdr.remote.web"
 name = "Herdr Remote Web"
-version = "0.2.31"
-min_herdr_version = "0.9.1"
+version = "0.2.33"
+min_herdr_version = "0.9.3"
 description = "Browser access to Herdr workspaces via local or self-hosted relay"
 platforms = ["linux", "macos", "windows"]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "herdr-remote",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Browser access to Herdr workspaces: plugin, host connector, and configuration TUI",
   "license": "MIT",
   "type": "module",